Identification – detection and analysis
A crucial concept to understand and develop as a core component of your incident response capability is the concept of incident triage. The reality is that not all incidents are treated the same, and by using a triage approach, you can focus on important events while ignoring irrelevant noise.
The following list offers a sampling of potential attack vectors that an attacker might use and an incident responder must be prepared to address. Each category is distinct in terms of exploitation and will require different mechanisms to discover abnormal behavior:
- Compromised credentials: Attacks made possible due to harvesting information system credentials:
- System (OS)/service account compromises
- User account compromises
- Web attacks: Attack vectors that use a web browser to install malware or harvest credentials:
- Drive-by downloads
- Cross-site scripting
- Removable media: Attacks delivered via removable media:
- USB thumb drives or DVDs...
